Distroless Image

ELI5 — The Vibe Check

Distroless images are Docker images with NOTHING in them except your app. No shell, no package manager, no ls, no curl — nothing an attacker could use. It's like delivering a package in a transparent box with no tools inside. Secure by subtraction.

Real Talk

Distroless container images, pioneered by Google, contain only the application and its runtime dependencies — no OS package manager, shell, or standard Linux utilities. This minimizes attack surface, reduces CVE exposure, and produces smaller images. Available for Java, Python, Node.js, Go, and .NET.

Show Me The Code

# Multi-stage build with distroless
FROM golang:1.22 AS builder
WORKDIR /app
COPY . .
RUN CGO_ENABLED=0 go build -o server .

FROM gcr.io/distroless/static-debian12
COPY --from=builder /app/server /
CMD ["/server"]

When You'll Hear This

"Our distroless image is 12MB and has zero CVEs from OS packages." / "You can't shell into a distroless container — that's the point."